Broken Access Control in CoopCycle Web Application

Executive Summary

CVE-2026-121945 is a Broken Object Level Authorization (BOLA) vulnerability in CoopCycle's web application. It allows any authenticated courier with ROLE_COURIER to read, modify, or delete any incident across the system, regardless of ownership. The flaw stems from improper authorization checks in the Incident API that only verify the user's role without validating incident ownership. Sequential incident IDs enable enumeration attacks where couriers can systematically access all incidents and perform unauthorized actions like rescheduling, canceling, or re-pricing orders from other stores.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor API logs for unauthorized PUT requests to /api/incidents/{id}/action endpoints. Check for sequential incident ID enumeration attempts or actions performed by couriers on incidents not assigned to them. Review access logs for abnormal read/write operations on incidents by non-admin users.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows couriers to access and manipulate incidents belonging to other users, stores, or customers. Attackers can cancel deliveries, reschedule tasks, change order totals, or access sensitive customer data. Financial losses may occur from unauthorized re-pricing, operational disruptions from canceled tasks, and privacy violations from exposed PII. The sequential incident IDs make it easy to exploit at scale.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personally identifiable information (PII) and sensitive customer data. GDPR requires strict data access controls and breach notification, while HIPAA mandates safeguards for protected health information. The flaw enables cross-tenant data exposure, potentially leading to regulatory fines, legal liabilities, and reputational damage for non-compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade CoopCycle web to version 6.20.1 or later. Implement strict object-level authorization checks in IncidentVoter.php to verify incident ownership before allowing modifications. Restrict PUT /api/incidents/{id}/action endpoints to authorized roles only. Audit all incident-related API endpoints for proper access controls.

Useful 0 Not Useful 0